SEC Begins Cyber Sweep of Investment Advisers with Focus on Cloud Storage

A sweep of investment advisers is underway by the U.S. Securities and Exchange Commission, which has sent out many letters to firms over the last week requesting information about their use of cloud providers.

The move could be part of the SEC’s Phase 3 Cybersecurity Exam Initiative, and is likely related to the April Regulation S-P Risk Alert about how firms are protecting personally identifiable information (PII) they store on cloud provider systems. Relatedly, the SEC may be interested in collecting information on whether firms are disclosing cloud vendors on Form ADV Schedule D, Item 1.L.

Many filers do not disclose cloud vendors on Form ADV, since the question asks for the location of books and records other than your office or principal place of business, and technically, records on cloud systems are accessible from a registrant’s office through a web browser. The Omgeo No-Action Letter from August 2009 permits advisers to store records in the cloud as long as the adviser can access those records from their office. Typically, we see firms disclose on the ADV the location of hard copy records, CDs, etc., at Iron Mountain or other physical storage vendors, as well as the locations of any alternate office locations at which original records are kept. Some firms do disclose cloud providers such as Global Relay, Smarsh and Mimecast, etc. although most don’t. SEC staff stated at a recent conference that it has observed an increased use of cloud providers by registrants.

Firms are using so many cloud vendors from portfolio management systems to Office365 to Dropbox to CSS’ own Ascendant Compliance Manager that the list in Section 1.L would likely be dozens of entries if every firm disclosed every location of electronic records. The SEC is interested in learning whether advisers have a handle on all the locations they are storing PII and other sensitive data. And in a new OCIE Risk Alert released May 23, 2019, “Safeguarding Customer Records and Information in Network Storage,” it is clear that the SEC is also focusing on whether advisers and broker-dealers have properly configured data storage solutions to use available security features to safeguard against unauthorized access. Maintaining a current data inventory of the locations of PII and which data is stored where, as well as conducting adequate oversight of these third party cloud providers, are essential components of a reasonably designed cybersecurity program.

CSS is currently running a “Getting Practical with Cyber” series of webinars. Our next, “In the Driver’s Seat: Your Critical Role in Cyber Resiliency,” takes place on June 11 at 2 pm ET. Register by clicking here.

For more information on how CSS can help you evaluate your cybersecurity program, visit our Shield page.

Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Latest Content

Service Provider Due Diligence – Building Effective Partnerships

In 2009, the SEC stated at its CCOutreach Program that “when a service provider is utilized, the adviser still retains its fiduciary responsibilities for the delegated services.” This philosophy is as true today as it was 10-plus years ago. Therefore, the question becomes how do you establish a due diligence oversight program for your firm’s … Continued

SEC Adopts Changes to Reporting Forms

Regulation of Derivatives Use by RICs and BDCs Recognizing the proliferation of new derivate products in our markets, the SEC voted to adopt a new regulatory framework for the use of derivatives by mutual funds, ETFs, closed-end funds, and business development companies. The SEC’s press release stated that, “The new rule and rule amendments will … Continued

Time to Use the Bat Phone: Who to Call When a Compliance Officer Needs Help?

It seems that the burden of work continues to increase for compliance professionals in the investment management industry. While also ensuring that their compliance program is effective, compliance officers must also be aware of cybersecurity threats, business continuity plans, new regulations, changes in business strategy, and more – all while doing this under a work … Continued